SepInitProcessAuditSd

VOID __stdcall SepInitProcessAuditSd(){
  struct _ACL *v0; 
  UINT32 v1; 
  struct _ACL *PoolWithTag; 
  struct _ACL *v3; 
  _ACL *v4; 
  int Acl; 
  UINT64 v6; 
  void *v7; 
  int v8; 
  UINT32 v9; 
  struct _ACL *v10; 
  ACL *v11; 
  UINT8 v12; 
  UINT8 v13; 
  v0 = 0i64;
  if( SepProcessAuditSd )
  {
    ExFreePoolWithTag(SepProcessAuditSd, 0);
    SepProcessAuditSd = 0i64;
  }
  if( SepProcessAccessesToAudit )
  {
    v1 = 4 * *((unsigned __int8 *)SeWorldSid + 1) + 24;
    PoolWithTag = (struct _ACL *)ExAllocatePoolWithTag(
                                   PagedPool,
                                   4 * (unsigned int)*((unsigned __int8 *)SeWorldSid + 1) + 64,
                                   0x64536553ui64);
    v3 = PoolWithTag;
    if( PoolWithTag )
    {
      v4 = PoolWithTag + 5;
      Acl = RtlCreateAcl(PoolWithTag + 5, v1, 2u);
      if( Acl < 0 )
        goto LABEL_20;
      Acl = RtlAddAuditAccessAce(v4, v6, SepProcessAccessesToAudit, v7, v12, v13);
      if( Acl < 0 )
        goto LABEL_20;
      Acl = RtlCreateSecurityDescriptor(v3, 1ui64);
      if( Acl < 0 )
        goto LABEL_20;
      Acl = RtlSetSaclSecurityDescriptor(v3, 1u, v4, 0);
      if( Acl < 0 )
        goto LABEL_20;
      SepProcessAuditSd = v3;
      v8 = *((unsigned __int8 *)SeLocalSystemSid + 1)
         + *(unsigned __int8 *)(*(_QWORD *)SeLocalServiceSid + 1i64)
         + *((unsigned __int8 *)SeNetworkServiceSid + 1)
         + *((unsigned __int8 *)SeIUserSid + 1);
      v9 = 4 * v8 + 72;
      v10 = (struct _ACL *)ExAllocatePoolWithTag(PagedPool, (unsigned int)(4 * v8 + 112), 0x64536553ui64);
      v0 = v10;
      if( v10 )
      {
        v11 = v10 + 5;
        Acl = RtlCreateAcl(v10 + 5, v9, 2u);
        if( Acl >= 0 )
        {
          Acl = RtlAddAccessAllowedAce(v11, 2u, 1u, SeLocalSystemSid);
          if( Acl >= 0 )
          {
            Acl = RtlAddAccessAllowedAce(v11, 2u, 1u, SeLocalServiceSid);
            if( Acl >= 0 )
            {
              Acl = RtlAddAccessAllowedAce(v11, 2u, 1u, SeNetworkServiceSid);
              if( Acl >= 0 )
              {
                Acl = RtlAddAccessAllowedAce(v11, 2u, 1u, SeIUserSid);
                if( Acl >= 0 )
                {
                  Acl = RtlCreateSecurityDescriptor(v0, 1ui64);
                  if( Acl >= 0 )
                  {
                    Acl = RtlSetDaclSecurityDescriptor(v0, 1u, v11, 0);
                    if( Acl >= 0 )
                    {
                      *(_QWORD *)SepImportantProcessSd = v0;
                      return;
                    }
                  }
                }
              }
            }
          }
        }
        goto LABEL_20;
      }
    }
    Acl = -1073741670;
LABEL_20:
    SepAuditFailed((unsigned int)Acl);
    if( v3 )
    {
      ExFreePoolWithTag(v3, 0);
      SepProcessAuditSd = 0i64;
    }
    if( v0 )
    {
      ExFreePoolWithTag(v0, 0);
      *(_QWORD *)SepImportantProcessSd = 0i64;
    }
  }
}

Referenced by: